Connect to Azure VM via SSH

How SSH Works

SSH creates an encrypted tunnel between your machine and the VM. Here's what happens when you run ssh azureuser@4.188.23.45:

1. Your SSH client connects to port 22 on the VM's public IP
2. The server sends its host key fingerprint — you verify it once on first connection
3. Your client proves your identity using your private key (or password)
4. An encrypted channel is established — everything is encrypted from this point
5. You get an interactive terminal prompt on the remote VM

Before You Connect

Make sure these are in place:

• VM is running (not deallocated)
• Port 22 is open in the VM's Network Security Group
• You have the VM's public IP address
• You have either the private key or the password for the admin account

az vm show \
  --resource-group myResourceGroup \
  --name myVM \
  --show-details \
  --query publicIps \
  --output tsv

Connect from Mac or Linux

SSH is built into macOS and Linux — open Terminal and connect directly:

# Connect with default key (~/.ssh/id_rsa)
ssh azureuser@4.188.23.45

# Connect with a specific key file
ssh -i ~/.ssh/my-azure-key azureuser@4.188.23.45

# Connect with verbose output (useful for debugging)
ssh -v azureuser@4.188.23.45

# Connect on a non-standard port (if SSH is not on port 22)
ssh -p 2222 azureuser@4.188.23.45

Connect from Windows

Windows 10/11 includes a built-in OpenSSH client. Open PowerShell or Command Prompt and use the same ssh commands as Mac/Linux.

# Same command works in PowerShell
ssh azureuser@4.188.23.45

# With a specific key file
ssh -i C:\Users\YourName\.ssh\id_rsa azureuser@4.188.23.45

SSH Config File — Simplify Connections

Typing the full SSH command every time is tedious. The SSH config file lets you create shortcuts:

# Edit or create ~/.ssh/config
# On Windows: C:\Users\YourName\.ssh\config

Host azure-prod
    HostName 4.188.23.45
    User azureuser
    IdentityFile ~/.ssh/id_rsa
    Port 22

Host azure-dev
    HostName 52.140.67.89
    User azureuser
    IdentityFile ~/.ssh/azure-dev-key
    Port 22

Now instead of typing the full command, just use:

ssh azure-prod
ssh azure-dev

SSH Port Forwarding

Port forwarding lets you securely access services running on the VM that aren't publicly exposed. For example, if a web app runs on port 8080 of the VM, you can access it locally:

# Forward local port 8080 to VM's port 8080
# After running this, open http://localhost:8080 in your browser
ssh -L 8080:localhost:8080 azureuser@4.188.23.45

# Forward local port 5432 to VM's PostgreSQL (port 5432)
ssh -L 5432:localhost:5432 azureuser@4.188.23.45

Copy Files with SCP

SCP (Secure Copy Protocol) uses SSH to transfer files securely:

# Copy a local file TO the VM
scp myfile.txt azureuser@4.188.23.45:/home/azureuser/

# Copy a file FROM the VM to local machine
scp azureuser@4.188.23.45:/home/azureuser/logs.txt ./logs.txt

# Copy an entire directory to the VM
scp -r ./myapp/ azureuser@4.188.23.45:/home/azureuser/myapp/

# Using SSH config alias
scp myfile.txt azure-prod:/home/azureuser/

Azure Bastion — SSH Without Opening Port 22

Opening SSH (port 22) to the internet exposes your VM to constant brute-force attempts. Azure Bastion is a managed service that provides browser-based SSH access without needing a public IP or open ports on your VM.

How Azure Bastion Works

Azure Bastion acts as a jump server inside your VNet. You connect to it through the Azure Portal over HTTPS (port 443). Bastion then connects to your VM over SSH on the private network — the VM doesn't need a public IP or open port 22.

Troubleshooting SSH Issues

Connection Refused (port 22)

• Check the NSG — is port 22 open for your IP?
• Is the VM running? (not deallocated)
• Check the correct public IP — it may have changed if using a dynamic IP

Permission Denied (publickey)

• Are you using the right private key? Try ssh -i /path/to/key
• Check key permissions: chmod 600 ~/.ssh/id_rsa (must be 600, not 644)
• Is the public key correctly installed in the VM's ~/.ssh/authorized_keys?

# SSH key permissions must be restricted
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Connection Timeout

• VM may be stopped or deallocated
• NSG may be blocking your IP — check what IP you're connecting from
• The VM may be in a different region and the public IP may have changed

Host Key Verification Failed

• This happens when you recreate a VM with the same IP — the host key changes
• Remove the old key: ssh-keygen -R 4.188.23.45
• Then connect again and accept the new host key